moving things around

monitoring/kube-state-metrics.yaml

@@ -3,55 +3,51 @@ kind: ServiceAccount
 metadata:
   name: kube-state-metrics
   namespace: monitoring
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
+automountServiceAccountToken: false
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 rules:
   - apiGroups: [""]
     resources:
       - nodes
       - pods
-      - services
-      - endpoints
-      - namespaces
-      - replicationcontrollers
+      - persistentvolumeclaims
     verbs: ["list", "watch"]
-  - apiGroups: ["extensions", "apps"]
+  - apiGroups: ["apps"]
     resources:
+      - statefulsets
       - daemonsets
       - deployments
       - replicasets
-      - statefulsets
     verbs: ["list", "watch"]
   - apiGroups: ["batch"]
     resources:
       - cronjobs
       - jobs
     verbs: ["list", "watch"]
-  - apiGroups: ["autoscaling"]
-    resources:
-      - horizontalpodautoscalers
-    verbs: ["list", "watch"]
-  - apiGroups: ["policy"]
-    resources:
-      - poddisruptionbudgets
-    verbs: ["list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources:
-      - storageclasses
-      - volumeattachments
-    verbs: ["list", "watch"]
-  - apiGroups: ["apps"]
-    resources:
-      - replicasets
-    verbs: ["list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: kube-state-metrics
+  labels:
+    app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -68,6 +64,9 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
   replicas: 1
   selector:
@@ -77,14 +76,46 @@ spec:
     metadata:
       labels:
         app: kube-state-metrics
+        app.kubernetes.io/component: exporter
+        app.kubernetes.io/name: kube-state-metrics
+        app.kubernetes.io/version: 2.19.1
     spec:
+      automountServiceAccountToken: true
       serviceAccountName: kube-state-metrics
+      nodeSelector:
+        kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets
           ports:
             - name: http-metrics
               containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http-metrics
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               cpu: 50m
@@ -100,10 +131,15 @@ metadata:
   namespace: monitoring
   labels:
     app: kube-state-metrics
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.19.1
 spec:
+  type: ClusterIP
+  selector:
+    app: kube-state-metrics
   ports:
     - name: http-metrics
       port: 8080
       targetPort: http-metrics
-  selector:
-    app: kube-state-metrics
+      protocol: TCP